Seems like you have set it up on Cron scheduling. While you can also setup hourly alert though cron schedule, there is already an option to Run every hour. Try editing the Alert Type and change Schedule. (Possibly run every hour for last 60 minutes, however, depends on your use case). Cron will give you more flexibility like run every hour between 9 AM to 5 PM only on Weekdays etc. However, for your question you can also set cron expression as 0 */1 * * *. I don't think you require a Throttle once you have setup alert to trigger hourly. However, Throttle is in place in Splunk to snooze alert for specific period once it has already triggered so that multiple alerts can be avoided to take and complete actionable items for alert already triggered. ... View more